# Frame-ancestors directive issues

**URL:** <https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270>\
**Category:** Help!\
**Created:** [November 27, 2018, 7:33pm UTC](https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270 "2018-11-27T19:33:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sam1](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sam1](https://discourse.haproxy.org/u/sam1)\
**Post date:** [November 27, 2018, 7:33pm UTC](https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270/1 "2018-11-27T19:33:21Z")

</div>

Hi, can someone help me with the right directive for frame-ancestors? I am using version 1.5.14. Here is the line that haproxy does not have issue in starting with but Chrome, Ver 70.0.3538.110, does not like it and complains that "Unrecognized Content-Security-Policy directive ‘frame-ancestors:’.

_ **http-response set-header Content-Security-Policy:frame-ancestors 'self’** _

Any help is really appreciated.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [November 27, 2018, 8:22pm UTC](https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270/2 "2018-11-27T20:22:44Z")

</div>

It should be:

`http-response set-header Content-Security-Policy "frame-ancestors 'self';"`

There needs to be a space between the header name and the header value, also if the header value contains spaces or single quotes, you need to put it into double quotes.

I don’t think this ever worked in a browser.

---

<div class="post-metadata">

**Author:** ![sam1](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sam1](https://discourse.haproxy.org/u/sam1)\
**Post date:** [November 27, 2018, 8:43pm UTC](https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270/3 "2018-11-27T20:43:18Z")

</div>

Thank you for your quick response. However, haproxy does not start with that syntax. Error log says _ **’http-response set-header’ expects exactly 2 arguments"** _

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [November 27, 2018, 9:04pm UTC](https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270/4 "2018-11-27T21:04:01Z")

</div>

Right, old haproxy 1.5 doesn’t like the double quotes.

Escape the space in the value instead:

`http-response set-header Content-Security-Policy frame-ancestors\ 'self';`

---

<div class="post-metadata">

**Author:** ![sam1](https://avatars.discourse-cdn.com/v4/letter/s/bc8723/32.png) [@sam1](https://discourse.haproxy.org/u/sam1)\
**Post date:** [November 27, 2018, 9:22pm UTC](https://discourse.haproxy.org/t/frame-ancestors-directive-issues/3270/5 "2018-11-27T21:22:10Z")

</div>

@lukastribus, that works 🙂. Thank you so much.